Inchcape Ignites Identity and Access
Management to Drive the Next Stage of
Their Digital Transformation Journey

The Solution

To ensure their IAM solution would adhere to this best practice approach, Inchcape consulted Gartner, an analyst firm, for recommendations. Nutt and his team whittled down the longlist of recommended vendors to a shortlist of three solutions, which progressed into a Proof of Concept phase for more detailed testing.

“We put all three vendors through their paces over several months,” says Nutt. “What we liked most about Ping Identity, and what ultimately made us choose its IAM solution, was its flexibility, neutrality, and competitive cost.”

“Ping did not favor any particular approach or vendor and proved it could integrate with every application across our estate,” says Nutt. “We also appreciated the deployment flexibility. It can run on any type of platform that we could potentially need whether that’s Linux, Windows, in the cloud using Docker and containers, or even as-a-service.”

The first phase of the project consolidated 26 individual Microsoft Active Directory forests spread across 33 countries into a single, globally available, and managed single sign-on (SSO) platform.

Next, the team began integrating a line of business applications used by sales, operations, marketing, and HR teams into a policy-driven single sign-on architecture. This integration process was simplified by several built-in connectors to popular applications plus deep support for key IAM standards such as SAML, OpenID, OAuth, SCIM, and Web Services Federation.

“After an initial learning curve, we quickly got up to speed and have integrated around 30 applications so far,” says Nutt. “This flexibility was critical for us and we now treat Ping like a Swiss Army knife—it can integrate anything with anything, once you know the basics,” he adds.

The security aspects of the project are also supported by regulatory constraints such as GDPR. “We hold data on customers from across the world and we need to make sure that only staff with the appropriate rights can access data in accordance with national and international data privacy regulations. Ping has become an active part of this governance process.”

The company has also implemented multi-factor authentication (MFA) controls for remote users that sign on from home or use mobile devices. The use of MFA and tokens has also been extended to the granting of admin-level privileges to critical systems to protect against insider attacks.

“One of our goals is to make access control simple while delivering a level of security that not just meets but exceeds best practice,” says Nutt, who points to the example of their cloud API server that requires authentication via Ping to negate the risk of shared, lost or stolen credentials.